There’s something I need to admit.
I’m not proud of it, but it’s time to get it off my chest and stop hiding, no matter how embarrassing it is.
You see, it happened way back in 1994. I was working as a paramedic at the time, so a lot of my decisions were affected by sleep deprivation.
Oh heck – I’ll just say it. One day I walked into a store, pulled out my checkbook, and bought a copy of OS/2 Warp. To top it off I then installed it on the only (dreadfully underpowered) laptop I could afford at the time.
I can’t really explain my decision. I think it was that geek hubris most of us pass through at some point in our young lives. I fell for the allure of a technically superior technology, completely ignoring the importance of the application ecosystem around it. I tried to pretend that more efficient memory management and true multitasking could make up for little things like being limited to about 1.5 models of IBM printers.
It wouldn’t be the last time I underestimated the power of ecosystem vs. technology. I’m also the guy who militantly avoided iPods in favor of generic MP3 players. I was thinking features, not design. Until I finally broke down and bought my first iPod, that is. The damn thing just worked, and it looked really nice in the process, even though it lacked external storage.
After Dropbox’s colossal screwup I started looking at alternatives again. I didn’t need to look very hard, because people emailed and tweeted some options pretty quickly. A few look very interesting, and they are all dramatically more secure.
The problem is that none of them look as polished or simple – never mind as stable. I’m not talking about giving up security for simplicity – Dropbox could easily keep their current simplicity and still encrypt on the client. I mean that Dropbox nailed the consumer cloud storage problem early and effectively, quickly building up an ecosystem around it. It’s this ecosystem that provides the corporate-level stability all the alternatives lack.
These alternatives do have a chance to make it if they learn the lessons of Dropbox and Apple; and pay as much attention to design, simplicity, and ecosystem as they do to raw technology. But none of them seem quite that mature yet, so I will mostly watch and play rather than dump what I’m doing and switch over completely.
Which is too bad. Because I’m starting to regret paying for Dropbox based on their latest error. If they address it directly, then it won’t be a long term problem at all. If they don’t I’ll have to eat my own dog food and move to an alternative provider that meets my minimum security requirements, even though they are at greater risk of failing. Which also forces me to always have contingency options so I don’t lose my data.
Sigh.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich quoted on RSA at The Street.
- Rich at Newsweek on Mac Defender.
- Rich on iPad security at Macworld. (Yes, I’m a major media whore this week).
- Our Dropbox story bit BoingBoing.
- Adrian over at Network Computing on GreenSQL.
Favorite Securosis Posts
- Adrian Lane: How to Encrypt Your Dropbox Files, at Least until Dropbox Wakes the F* up. Great product but they need to fix both server and client side security architectures.
- David Mortman: Tokenization vs. Encryption: Payment Data Security.
- Rich: My older Securing Cloud Data with Virtual Private Storage post.
Other Securosis Posts
- 7 Myths, Expanded.
- IaaS Storage 101.
- Is Your Email Address Worth More Than Your Credit Card Number?
- New White Paper: Security Benchmarking: Going Beyond Metrics.
Favorite Outside Posts
- Adrian Lane: Creating Public AMIs Securely for EC2. This is difficult to do correctly.
- David Mortman: Security Expert, Gunnar Peterson, on Leveraging Enterprise Credentials to connect with Cloud applications.
- Rich: Why Sony is no surprise. A true must-read. Simplicity doesn’t scale.
- Chris Pepper: Fired IT manager hacks into CEO’s presentation, replaces it with porn. I’m more amused than the fired manager or the CEO.
Research Reports and Presentations
- Security Benchmarking: Going Beyond Metrics.
- Understanding and Selecting a File Activity Monitoring Solution.
- Database Activity Monitoring: Software vs. Appliance.
- React Faster and Better: New Approaches for Advanced Incident Response.
- Measuring and Optimizing Database Security Operations (DBQuant).
- Network Security in the Age of Any Computing.
- The Securosis 2010 Data Security Survey.
- Monitoring up the Stack: Adding Value to SIEM.
Top News and Posts
- Dropbox Left User Accounts Unlocked for 4 Hours Sunday. Feeling like a sooper-genius for encrypting my stuff Saturday.
- Antichat Forum Hacker Breach. Shocker – they used weak passwords.
- Teen Alleged Member of LulzSec.
- Interesting Graphic on data breaches.
- Toward Trusted Infrastructure for the Cloud Era.
- Pentagon Gets Cyberwar Guidelines.
- New views into the 2011 DBIR.
- Mozilla retires Firefox 4 from security support.
- Northrop Grumman constantly under attack by cyber-gangs.
- Analysis: LulzSec trackers say authorities are closing.
- WordPress.com hacked.
- Amazon’s cloud is full of holes.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Mark, in response to Is Your Email Address Worth More Than Your Credit Card Number?.
Spot on Rich. NIST already defines Email address as PII under 800-122. It seems everyone’s turning a bind eye to the contextual aspect today – conveniently. http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf “One of the most widely used terms to describe personal information is PII. Examples of PII range from an individual’s name or email address to an individual’s financial and medical records or criminal history.” In my opinion, what’s often worse is that an email address is also now a primary index to social networking sites (facebook, LinkedIn etc) which immediately presents more gold to mine for a spearphishing attack to present a APT payload – even if the attacker doesn’t have complete access, its all too easy these days to build a personal profile from one data element. TIme to turn that gold into straw again where its stored – including email addresses ? I think so.
Comments